AI Conversations Are Evidence. Collect Them That Way.

People now talk to AI assistants the way they talk to colleagues, and often more candidly. Agentic Collect, Right Forensics' AI conversation and agent collection service, collects those conversations the way we collect any chat between custodians, subjects and witnesses, then goes further. We reconstruct who asked what, what the assistant or agent did in response, including its searches and tool calls, and what the person did with the answer, and deliver it all in RSMF.

Why AI conversations matter

A text thread shows what someone chose to say to another person. A conversation with an AI assistant often shows something closer to how that person was thinking: the questions they could not answer themselves, the drafts they tried out, the shortcuts they considered.

That record can answer questions no other source reaches:

  • How much was outsourced. Did the person direct the work, or hand it over? The conversation shows whether the assistant was used as a tool under someone's control, or whether judgment and authority passed to the machine. That line matters most when the person is an expert, or presents as one.
  • Whether anyone checked the work. Prompts and follow-ups show whether the user gave clear direction, questioned the output, did their own analysis, or verified sources and figures. A lack of scrutiny is visible in the record.
  • Intent. A bad actor's own words to an assistant (what they asked for, what they planned, what they tried to hide) can be among the most revealing evidence in a matter.
  • Responsibility. For professionals and experts, the record can show whether a report, analysis or opinion reflects their own work or largely unreviewed AI output.
  • Movement of information. Uploaded files and pasted text are a potential vector for confidential or company data. The conversation can show what went in and when.

What we do

  • Identify the sources. We map which AI platforms and accounts a custodian used, personal and business, including traces left on laptops and phones that point to accounts not yet collected.
  • Preserve the account record. Where possible we work from the platform's own account data export, preserved exactly as delivered and hashed on receipt. Screen captures can corroborate, but they show what an interface displayed, not what the account stores.
  • Attribute the activity. We use device and account artifacts to tie AI use to a particular account and person, and to separate personal accounts from business ones.
  • Reconstruct the full conversation. Beyond the visible back-and-forth, we capture what the assistant or agent did along the way, as the platform export or device records it: web searches, tool calls and their results, generated files, visible reasoning, and uploaded documents. We record which model or mode produced each response, and keep edited prompts and regenerated answers rather than flattening them into a single thread.
  • Deliver for review. Conversations are converted to RSMF so your review team can search and read them in the same platform as the custodian's texts and messaging apps.

When attorneys need it

  • Departing-employee and trade-secret matters where company information may have been pasted into, uploaded to or summarized by an AI tool.
  • Disputes over who actually prepared a report, analysis, filing or expert opinion.
  • Fraud, misconduct and internal investigations where the subject's planning may sit in AI conversations.
  • Challenges to an opposing expert whose work may lean on AI output that was never verified.
  • Testing factual assertions made in correspondence or discovery against what the devices and accounts actually show.
  • Preservation and discovery planning, when you need to know which AI sources exist and how to request them.

How we work

Same discipline as any chat collection. AI accounts are scoped, preserved, hashed and documented with the same care as phones, email and messaging apps, and placed on the same data-source map.

Structure kept, not flattened. AI conversations branch. A user can edit a prompt or regenerate a response, and an export may contain answers the user never saw on the final path, or only one path. We record branches, edits and which responses were on the path the user actually saw, where the export allows that to be determined.

Every line labeled by origin. Each entry is marked as a user prompt, an assistant response, a tool or search result, reasoning content, text extracted from an attachment, or a generated file. A reviewer can see who, or what, produced every line.

Hidden context surfaced. Custom instructions, saved memories and project files can shape responses without appearing in the chat. When the export carries them, we report them as a separate note on the conversation.

Limits stated plainly. Exports differ in which timestamps they keep, and conversations deleted before export generally do not appear, with no notice that anything is missing. We state those limits as properties of the source, not as findings about the person, and we never infer a message time without saying so.

Annotations kept apart from content. Our examiner notes travel inside the deliverable in clearly labeled fields, separate from the source text, so the fidelity of the conversation itself is never in question.

What you get

Every Agentic Collect delivery includes:

  • AI conversations in RSMF, with agent and tool activity (searches, tool calls and their results, generated files) captured alongside the prompts and responses, load-ready for your review platform and searchable alongside the custodian's other messaging.
  • Review fields your team can filter on: content origin, model or mode, branch and edit flags, attachment status and timestamp basis.
  • A production note for each delivery explaining what was collected, how it was processed and any limits of the source. Searches with no responsive results get their own note explaining what was searched and why nothing was produced.
  • Hash values for the export as received and for each produced file, with request and delivery dates recorded.
  • Where needed, a written memo on attribution, exfiltration vectors or the specific factual questions counsel has asked.

CASE STUDIES

Details are generalized to protect the matters and the people involved.

AI accounts in a departed-executive investigation

The question. Counsel was investigating whether company information left with departing executives, and where it went afterward. The sources included work laptops, a personal phone, a thumb drive, personal webmail and personal accounts on consumer AI chat platforms.

What we did.

  • Built a data-source map that identified the personal AI accounts and flagged them for collection alongside the devices.
  • Reviewed each executive's laptop across ten categories of potential exfiltration, with generative AI as a category of its own, and found traces of AI platform use.
  • Used laptop artifacts to separate a personal AI account from a business account and attribute the activity.
  • Tested specific factual statements made in correspondence about AI use against what the laptop artifacts actually showed.
  • Converted a personal AI account export to RSMF and reviewed it with the custodian's phone, thumb drive and webmail data, as part of an analysis of whether company information reached third parties.

Why it mattered. The AI accounts were treated as first-class sources, not an afterthought. Because they were converted into the same review format as the rest of the messaging, counsel could follow a single timeline across devices, email and AI conversations.

Why richer RSMF holds up

The question. In a separate audit-related collection, messaging from three custodians' phones was produced in RSMF. After delivery, two different commercial processing tools were run on the same data as a quality check.

What we found. The two tools agreed exactly on the substance: the same conversations, dates and message counts. They differed sharply in presentation. One tool's custodian label inserted a common word into roughly seven of every ten documents, which would have produced thousands of false search hits. Other differences included time-zone handling that split some conversation-days across two local dates, encoding that broke words apart and defeated search, and summary counts in a tool's own logs that did not reconcile with its output.

Why it mattered. Because each of those issues was already measured and noted on the documents it affected, reviewers had the explanation in front of them, not a list of questions for later. We bring the same approach to AI conversations, which reviewers find even less familiar.

Frequently asked questions

Which AI platforms can you collect?

We work with major consumer and business AI assistants, including ChatGPT, Grok and Claude, and we assess others case by case. What can be preserved depends on what each platform's export and the custodian's devices actually contain.

Can you recover deleted AI conversations?

Sometimes, partly. Platform exports generally leave out conversations deleted before the export, without saying so. Traces may remain on devices or in other sources. We will tell you what each source can and cannot show.

Are screenshots good enough?

They can corroborate, but they show what a screen displayed, not what the account holds. They also miss branches, edits, attachments and tool activity.

What does "agent" or tool activity mean here?

Modern assistants do more than chat. They search the web, run tools, read uploaded files and produce documents. Agentic Collect captures those steps as the platform or device records them and labels each one, so you can tell what the person wrote, what the assistant wrote and what the assistant did.

Why RSMF?

RSMF lets your review team read AI conversations in the same platform, with the same search and coding tools, as the custodian's texts and chat apps.

AI conversations may hold the clearest record of what someone knew, intended or failed to check. Tell us about your matter and we'll map the sources and how to preserve them.

START A CONVERSATION